[PATCH] nvme: make the DH-HMAC-CHAP secret attributes readable by root only

[PATCH] nvme: make the DH-HMAC-CHAP secret attributes readable by root only

[Martin Belanger]

The dhchap_secret and dhchap_ctrl_secret sysfs attributes have mode
0644. Their show functions return the secret, so any local user can
read the DH-HMAC-CHAP secrets of a connected controller.

Change the mode to 0600. Writing the attributes was already limited to
root and is not changed.

Fixes: f50fff73d620 ("nvme: implement In-Band authentication")
Cc: stable@vger.kernel.org
Cc: Daniel Wagner <wagi@kernel.org>
Assisted-by: LLM
Signed-off-by: Martin Belanger <martin.nvme.dev@gmail.com>
---
 drivers/nvme/host/sysfs.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/nvme/host/sysfs.c b/drivers/nvme/host/sysfs.c
index e1e3dcfd084b..e0cb34545b97 100644
--- a/drivers/nvme/host/sysfs.c
+++ b/drivers/nvme/host/sysfs.c
@@ -864,7 +864,7 @@ static ssize_t nvme_ctrl_dhchap_secret_store(struct device *dev,
 	return count;
 }
 
-static DEVICE_ATTR(dhchap_secret, S_IRUGO | S_IWUSR,
+static DEVICE_ATTR(dhchap_secret, 0600,
 	nvme_ctrl_dhchap_secret_show, nvme_ctrl_dhchap_secret_store);
 
 static ssize_t nvme_ctrl_dhchap_ctrl_secret_show(struct device *dev,
@@ -922,7 +922,7 @@ static ssize_t nvme_ctrl_dhchap_ctrl_secret_store(struct device *dev,
 	return count;
 }
 
-static DEVICE_ATTR(dhchap_ctrl_secret, S_IRUGO | S_IWUSR,
+static DEVICE_ATTR(dhchap_ctrl_secret, 0600,
 	nvme_ctrl_dhchap_ctrl_secret_show, nvme_ctrl_dhchap_ctrl_secret_store);
 #endif
 
-- 
2.53.0

Re: [PATCH] nvme: make the DH-HMAC-CHAP secret attributes readable by root only

[Greg KH]

On Tue, Oct 13, 2026 at 01:32:41PM -0400, Martin Belanger wrote:
> The dhchap_secret and dhchap_ctrl_secret sysfs attributes have mode
> 0644. Their show functions return the secret, so any local user can
> read the DH-HMAC-CHAP secrets of a connected controller.
> 
> Change the mode to 0600. Writing the attributes was already limited to
> root and is not changed.
> 
> Fixes: f50fff73d620 ("nvme: implement In-Band authentication")
> Cc: stable@vger.kernel.org
> Cc: Daniel Wagner <wagi@kernel.org>
> Assisted-by: LLM
> Signed-off-by: Martin Belanger <martin.nvme.dev@gmail.com>
> ---
>  drivers/nvme/host/sysfs.c | 4 ++--
>  1 file changed, 2 insertions(+), 2 deletions(-)
> 
> diff --git a/drivers/nvme/host/sysfs.c b/drivers/nvme/host/sysfs.c
> index e1e3dcfd084b..e0cb34545b97 100644
> --- a/drivers/nvme/host/sysfs.c
> +++ b/drivers/nvme/host/sysfs.c
> @@ -864,7 +864,7 @@ static ssize_t nvme_ctrl_dhchap_secret_store(struct device *dev,
>  	return count;
>  }
>  
> -static DEVICE_ATTR(dhchap_secret, S_IRUGO | S_IWUSR,
> +static DEVICE_ATTR(dhchap_secret, 0600,
>  	nvme_ctrl_dhchap_secret_show, nvme_ctrl_dhchap_secret_store);

DEVICE_ATTR_ADMIN_RW() perhaps?

And no need to cc: security@k.o for public patches.

thanks,

greg k-h